diff --git a/packages/x402-mcp/CHANGELOG.md b/packages/x402-mcp/CHANGELOG.md index 4992ff5..d5dfed5 100644 --- a/packages/x402-mcp/CHANGELOG.md +++ b/packages/x402-mcp/CHANGELOG.md @@ -1,5 +1,11 @@ # Changelog +## 0.11.0 + +- Trust query-string variants of a query-free catalog URL after the same live + money-field verification, via `openpay-x402-sdk` 0.2.x. +- Preserve all MCP tool names, descriptions, and input schemas byte-for-byte. + ## 0.10.0 - Delegate payment execution, catalog resolution, guards, payment wire handling, diff --git a/packages/x402-mcp/README.md b/packages/x402-mcp/README.md index f10de81..1a4591c 100644 --- a/packages/x402-mcp/README.md +++ b/packages/x402-mcp/README.md @@ -173,10 +173,13 @@ Ordering flow (autonomous): `find_shops` → `order_menu` → pick items → `or | `STEWARD_SIGNER_SECRET` | unset | Required when `SIGNER_MODE=steward`; scoped signer secret. Treated as a secret. | | `MAX_PER_CALL_JPYC` | `10` | Upper bound for the tool call's required `maxTotalJpyc`. | | `MAX_SESSION_JPYC` | `100` | Process-lifetime cumulative cap for successful `x402_pay` calls. Restarting the process resets it. | -| `CATALOG_TRUST` | `true` | When true, URLs listed (exact match) in the OpenPay discovery catalog are payable without editing `ALLOWED_HOSTS`. Before signing, the live `accepts` fetched from a catalog URL is checked field-by-field (asset / forwarder / merchant / fee receiver / amounts) against the catalog listing (server-authored), so a third-party domain cannot bait-and-switch a different destination; mismatches are refused (`catalog_accept_mismatch`). Money caps still apply. Set `false` for strict manual allowlisting. | +| `CATALOG_TRUST` | `true` | When true, URLs listed in the OpenPay discovery catalog are payable without editing `ALLOWED_HOSTS`. Before signing, the live `accepts` fetched from a catalog URL is checked field-by-field (asset / forwarder / merchant / fee receiver / amounts) against the catalog listing (server-authored), so a third-party domain cannot bait-and-switch a different destination; mismatches are refused (`catalog_accept_mismatch`). Money caps still apply. Set `false` for strict manual allowlisting. | | `ALLOWED_HOSTS` | `open-pay.jp` | Comma-separated bare host allowlist. `x402_quote` still works outside the list but returns `host_not_allowed`. | | `DISCOVERY_URL` | `https://open-pay.jp/api/discovery` | Catalog used by `discovery_search`. | +Query string variants of a query-free listed URL are trusted after the same +money-field verification; query-bearing catalog entries remain exact-only. + ## Signer Modes `env-key` is the default zero-config mode. It is convenient for local testing and should use a dedicated low-balance wallet. diff --git a/packages/x402-mcp/package-lock.json b/packages/x402-mcp/package-lock.json index f636851..ad7707e 100644 --- a/packages/x402-mcp/package-lock.json +++ b/packages/x402-mcp/package-lock.json @@ -1,15 +1,15 @@ { "name": "openpay-x402-mcp", - "version": "0.10.0", + "version": "0.11.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "openpay-x402-mcp", - "version": "0.10.0", + "version": "0.11.0", "dependencies": { "@modelcontextprotocol/sdk": "^1.18.0", - "openpay-x402-sdk": "^0.1.0", + "openpay-x402-sdk": "^0.2.0", "viem": "^2.45.0" }, "bin": { @@ -927,9 +927,9 @@ } }, "node_modules/openpay-x402-sdk": { - "version": "0.1.0", - "resolved": "https://registry.npmjs.org/openpay-x402-sdk/-/openpay-x402-sdk-0.1.0.tgz", - "integrity": "sha512-1KyeuUxnV8pTlgyijTreFUwLiFmbFqBIO7wMrZV0Dj/HUfDUYtasDht3kCMv9CeU+kcMM0/I68SFJ+ZgCbozNQ==", + "version": "0.2.0", + "resolved": "https://registry.npmjs.org/openpay-x402-sdk/-/openpay-x402-sdk-0.2.0.tgz", + "integrity": "sha512-56Sw1iqK6lW4eflJ3OqklYTzPTpIRwNIuw8KGiAuw7NiGNAh3CpSt8EOGQvGaZgubayrV7rtFJyrwGnqnyz2bQ==", "dependencies": { "viem": "^2.45.0" }, diff --git a/packages/x402-mcp/package.json b/packages/x402-mcp/package.json index 7c4f390..225d0a8 100644 --- a/packages/x402-mcp/package.json +++ b/packages/x402-mcp/package.json @@ -1,6 +1,6 @@ { "name": "openpay-x402-mcp", - "version": "0.10.0", + "version": "0.11.0", "description": "Local MCP buyer for OpenPay x402 JPYC resources", "type": "module", "bin": { @@ -20,7 +20,7 @@ }, "dependencies": { "@modelcontextprotocol/sdk": "^1.18.0", - "openpay-x402-sdk": "^0.1.0", + "openpay-x402-sdk": "^0.2.0", "viem": "^2.45.0" } }